Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

powerOff.exe

Gen1 Malicious Library UPX PE64 PE File OS Processor Check PE32 DLL

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 25, 2022, 10:36 p.m.	Nov. 25, 2022, 10:40 p.m.

Size	838.7KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`c0538198613d60407c75c54c55e69d91`
SHA256	`c23f223e4d981eb0e24cadae9dc0c60e40e12ff220d95c9dd2a5b6220fa6d6ed`
CRC32	`A2395C84`
ssdeep	`12288:+Qi3reTWxN15q3ZsRfGGduNOXPTd7yts/G6UWi9P3P5cN1IGh0nqPjU6xg7:+QiuWl55R+OeOX7UeRAP3xcNLeqPjUX`
Yara	IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file

powerOff.exe "C:\Users\test22\AppData\Local\Temp\powerOff.exe"
2544
- powerOff.tmp "C:\Users\test22\AppData\Local\Temp\is-NCHSR.tmp\powerOff.tmp" /SL5="$80178,490199,350720,C:\Users\test22\AppData\Local\Temp\powerOff.exe"
  2604
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 25, 2022, 10:36 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 25, 2022, 10:36 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

Allocates read-write-execute memory (usually to unpack itself) (7 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Nov. 25, 2022, 10:36 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Nov. 25, 2022, 10:36 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 40960 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Nov. 25, 2022, 10:36 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 315392 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040f000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Nov. 25, 2022, 10:36 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Nov. 25, 2022, 10:36 p.m.	process_identifier: 2604 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Nov. 25, 2022, 10:36 p.m.	process_identifier: 2604 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Nov. 25, 2022, 10:30 p.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004130000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Nov. 25, 2022, 10:36 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 8468295145849449705 root_path: C:\Program Files (x86)\powerOff\ total_number_of_bytes: 4294967295		0	0
GetDiskFreeSpaceExW Nov. 25, 2022, 10:36 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 13321908224 root_path: C:\Program Files (x86)\ total_number_of_bytes: 34252779520	1	1	0

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\is-GQAJ9.tmp\_isetup\_shfoldr.dll

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\is-NCHSR.tmp\powerOff.tmp
file	C:\Users\test22\AppData\Local\Temp\is-GQAJ9.tmp\_isetup\_shfoldr.dll

Queries for potentially installed applications (2 events)

Time & API	Arguments	Status	Return	Repeated
RegOpenKeyExA Nov. 25, 2022, 10:36 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{A99C48CB-3323-443F-88FB-F6FF96326429}_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{A99C48CB-3323-443F-88FB-F6FF96326429}_is1		2	0
RegOpenKeyExA Nov. 25, 2022, 10:36 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{A99C48CB-3323-443F-88FB-F6FF96326429}_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{A99C48CB-3323-443F-88FB-F6FF96326429}_is1		2	0

File has been identified by 16 AntiVirus engines on VirusTotal as malicious (16 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
McAfee	Artemis!C0538198613D
Cylance	Unsafe
Cybereason	malicious.098bc7
VirIT	Adware.Win32.Genus.DFS
APEX	Malicious
Comodo	Malware@#cxtfpwmojt28
TrendMicro	PUA.Win32.PowerOff.A
McAfee-GW-Edition	BehavesLike.Win32.AdwareFileTour.cc
Webroot	W32.Malware.Gen
Antiy-AVL	RiskWare/Perhaps.PowerOff
Gridinsoft	Malware.Win32.GenericMC.cc
Malwarebytes	Trojan.Dropper
TrendMicro-HouseCall	PUA.Win32.PowerOff.A
Fortinet	Riskware/PowerOff